The D003 register layout is as following (PRG-A18 is in different position according to http://wiki.nesdev.com/w/index.php/NES_2.0_Mapper_358, so the ROM dump might no work properly under nesdev-wiki's mapper description)
D003: [.ed..cba]
|| |||
|| ||+- CHR-A18
|| |+-- PRG-A18
|| +--- CHR-A19
|+------- when 0 - CHR-A18 is controlled by `bit a`, when 1 - by $9000-$9007 regs
+-------- when 0 - CHR-A19 is controlled by `bit c`, when 1 - CHR A19 becomes open bus,
Other info:
* There are 3 jumpers in the PCB: two selects what $5000.8-7 returns and the third one chooses what is wired into mapper-CPU-A11 (either CPU-A11 which is default or GND)
* PRG A17 and CHR A17 seems to be locked both to 1 (I needed to drive them from external hardware to dump the cart)
* Something is wrong with CHR mode bits - when the high bit of CHR-mode is being set, it cannot be cleared until power-up (if the mode is set to %10 / %11, then later when it is set to %00 / %01 / %10 / %11,
it behaves like it was set to %10 / %11 / %10 / %11). Either this is intentional or bug inside mapper blob)